CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The newly listed vulnerabilities affect Plex Media Server and include server-side request forgery, improper neutralization of URI schemes, and external control of file name or path issues. Additionally, vulnerabilities in EG Secure Solutions SiteGuard Server Edition and Siemens Software Center, related to OS command injection and uncontrolled search path elements respectively, have been added. These types of vulnerabilities are common attack vectors for cyber actors and present significant risks. Federal Civilian Executive Branch agencies are required by Binding Operational Directive 26-04 to prioritize the remediation of high-risk vulnerabilities listed in the KEV Catalog. This directive emphasizes rapid patching of vulnerabilities on publicly exposed assets that allow for total control post-exploitation. Agencies are also expected to check for compromises before applying patches. While BOD 26-04 is specific to federal agencies, CISA encourages all organizations to adopt risk-based vulnerability management. CISA will continue to update the KEV Catalog with new exploited vulnerabilities. Organizations can nominate exploited vulnerabilities not yet in the catalog for consideration if they have a CVE ID, exploitation evidence, and mitigation guidance.